search

JPCERTCC / LogonTracer

Investigate malicious Windows logon by visualizing and analyzing Windows event log
Other
2.7k stars 441 forks source link

Errror when importing evtx file #113

Closed themeswordpress closed 2 years ago

themeswordpress commented 3 years ago

2.168.1.132 [+] Script start. 2021/07/16 01:42:23 [+] Neo4j Kernel version: 4.2.6 [+] Delete all nodes and relationships from this Neo4j database. [+] make cache folder /home/xxxxxx/LogonTracer/cache. [+] Time zone is 9. [+] Last record number is 84976. [+] Start parsing the EVTX file. [+] Parse the EVTX file /home/xxxxxx/Desktop/SecurityLog.evtx. [+] Now loading 84800 records.Traceback (most recent call last): File "logontracer.py", line 1857, in main() File "logontracer.py", line 1842, in main parse_evtx(args.evtx) File "logontracer.py", line 1018, in parse_evtx if data.get("Name") in "AuthenticationPackageName" and re.search(r"\A\w*\Z", data.text): File "/usr/lib/python3.6/re.py", line 182, in search return _compile(pattern, flags).search(string) TypeError: expected string or bytes-like object

shu-tom commented 2 years ago

This error means that the EVTX file contains unexpected data in the AuthenticationPackageName column and this file may be corrupted.